@yawlabs/ctxlint 0.9.4 → 0.9.6

package/context-lint-rules.json

@@ -148,17 +148,6 @@
       "fixable": false,
       "stability": "stable"
     },
-    {
-      "id": "commands/npm-auth-trap",
-      "category": "commands",
-      "severity": "info",
-      "description": "Context file documents an npm write operation (deprecate, unpublish, dist-tag, access, owner) as a local CLI command. Under WebAuthn-only 2FA (no TOTP authenticator), these commands return 422 because npm treats CLI web-auth tokens as not-2FA-authenticated for writes. The npm website settings UI is the only path that works; CI-driven workflows are the scalable alternative.",
-      "trigger": "Context file references `npm deprecate`, `npm unpublish`, `npm dist-tag add/rm/set`, `npm access grant/revoke/2fa`, or `npm owner add/rm` as a command.",
-      "message": "\"{cmd}\" — npm {op} requires a 2FA-authenticated session; CLI returns 422 under WebAuthn-only auth",
-      "fixable": false,
-      "stability": "experimental",
-      "source": "https://docs.npmjs.com/requiring-2fa-for-package-publishing-and-settings-modification"
-    },
     {
       "id": "staleness/stale",
       "category": "staleness",

package/dist/index.js

@@ -25639,7 +25639,7 @@ var require_compile = __commonJS({
       }
     }
     exports.compileSchema = compileSchema;
-    function resolveRef2(root, baseId, ref) {
+    function resolveRef3(root, baseId, ref) {
       var _a3;
       ref = (0, resolve_1.resolveUrl)(this.opts.uriResolver, baseId, ref);
       const schOrFunc = root.refs[ref];
@@ -25656,7 +25656,7 @@ var require_compile = __commonJS({
         return;
       return root.refs[ref] = inlineOrCompile.call(this, _sch);
     }
-    exports.resolveRef = resolveRef2;
+    exports.resolveRef = resolveRef3;
     function inlineOrCompile(sch) {
       if ((0, resolve_1.inlineRef)(sch.schema, this.opts.inlineRefs))
         return sch.schema;
@@ -34482,473 +34482,28 @@ var init_scanner = __esm({
   }
 });
 
-// node_modules/.pnpm/tiktoken@1.0.22/node_modules/tiktoken/tiktoken_bg.cjs
-var require_tiktoken_bg = __commonJS({
-  "node_modules/.pnpm/tiktoken@1.0.22/node_modules/tiktoken/tiktoken_bg.cjs"(exports, module) {
-    var wasm;
-    module.exports.__wbg_set_wasm = function(val) {
-      wasm = val;
-    };
-    var lTextDecoder = typeof TextDecoder === "undefined" ? (0, module.require)("util").TextDecoder : TextDecoder;
-    var cachedTextDecoder = new lTextDecoder("utf-8", { ignoreBOM: true, fatal: true });
-    cachedTextDecoder.decode();
-    var cachedUint8ArrayMemory0 = null;
-    function getUint8ArrayMemory0() {
-      if (cachedUint8ArrayMemory0 === null || cachedUint8ArrayMemory0.byteLength === 0) {
-        cachedUint8ArrayMemory0 = new Uint8Array(wasm.memory.buffer);
-      }
-      return cachedUint8ArrayMemory0;
-    }
-    function getStringFromWasm0(ptr, len) {
-      ptr = ptr >>> 0;
-      return cachedTextDecoder.decode(getUint8ArrayMemory0().subarray(ptr, ptr + len));
-    }
-    var heap = new Array(128).fill(void 0);
-    heap.push(void 0, null, true, false);
-    var heap_next = heap.length;
-    function addHeapObject(obj) {
-      if (heap_next === heap.length) heap.push(heap.length + 1);
-      const idx = heap_next;
-      heap_next = heap[idx];
-      heap[idx] = obj;
-      return idx;
-    }
-    function handleError(f, args) {
-      try {
-        return f.apply(this, args);
-      } catch (e) {
-        wasm.__wbindgen_export_0(addHeapObject(e));
-      }
-    }
-    function getObject(idx) {
-      return heap[idx];
-    }
-    function dropObject(idx) {
-      if (idx < 132) return;
-      heap[idx] = heap_next;
-      heap_next = idx;
-    }
-    function takeObject(idx) {
-      const ret = getObject(idx);
-      dropObject(idx);
-      return ret;
-    }
-    var WASM_VECTOR_LEN = 0;
-    var lTextEncoder = typeof TextEncoder === "undefined" ? (0, module.require)("util").TextEncoder : TextEncoder;
-    var cachedTextEncoder = new lTextEncoder("utf-8");
-    var encodeString = typeof cachedTextEncoder.encodeInto === "function" ? function(arg, view) {
-      return cachedTextEncoder.encodeInto(arg, view);
-    } : function(arg, view) {
-      const buf = cachedTextEncoder.encode(arg);
-      view.set(buf);
-      return {
-        read: arg.length,
-        written: buf.length
-      };
-    };
-    function passStringToWasm0(arg, malloc, realloc) {
-      if (realloc === void 0) {
-        const buf = cachedTextEncoder.encode(arg);
-        const ptr2 = malloc(buf.length, 1) >>> 0;
-        getUint8ArrayMemory0().subarray(ptr2, ptr2 + buf.length).set(buf);
-        WASM_VECTOR_LEN = buf.length;
-        return ptr2;
-      }
-      let len = arg.length;
-      let ptr = malloc(len, 1) >>> 0;
-      const mem = getUint8ArrayMemory0();
-      let offset = 0;
-      for (; offset < len; offset++) {
-        const code = arg.charCodeAt(offset);
-        if (code > 127) break;
-        mem[ptr + offset] = code;
-      }
-      if (offset !== len) {
-        if (offset !== 0) {
-          arg = arg.slice(offset);
-        }
-        ptr = realloc(ptr, len, len = offset + arg.length * 3, 1) >>> 0;
-        const view = getUint8ArrayMemory0().subarray(ptr + offset, ptr + len);
-        const ret = encodeString(arg, view);
-        offset += ret.written;
-        ptr = realloc(ptr, len, offset, 1) >>> 0;
-      }
-      WASM_VECTOR_LEN = offset;
-      return ptr;
-    }
-    function isLikeNone(x3) {
-      return x3 === void 0 || x3 === null;
-    }
-    var cachedDataViewMemory0 = null;
-    function getDataViewMemory0() {
-      if (cachedDataViewMemory0 === null || cachedDataViewMemory0.buffer.detached === true || cachedDataViewMemory0.buffer.detached === void 0 && cachedDataViewMemory0.buffer !== wasm.memory.buffer) {
-        cachedDataViewMemory0 = new DataView(wasm.memory.buffer);
-      }
-      return cachedDataViewMemory0;
-    }
-    var cachedUint32ArrayMemory0 = null;
-    function getUint32ArrayMemory0() {
-      if (cachedUint32ArrayMemory0 === null || cachedUint32ArrayMemory0.byteLength === 0) {
-        cachedUint32ArrayMemory0 = new Uint32Array(wasm.memory.buffer);
-      }
-      return cachedUint32ArrayMemory0;
-    }
-    function getArrayU32FromWasm0(ptr, len) {
-      ptr = ptr >>> 0;
-      return getUint32ArrayMemory0().subarray(ptr / 4, ptr / 4 + len);
-    }
-    function passArray8ToWasm0(arg, malloc) {
-      const ptr = malloc(arg.length * 1, 1) >>> 0;
-      getUint8ArrayMemory0().set(arg, ptr / 1);
-      WASM_VECTOR_LEN = arg.length;
-      return ptr;
-    }
-    function passArray32ToWasm0(arg, malloc) {
-      const ptr = malloc(arg.length * 4, 4) >>> 0;
-      getUint32ArrayMemory0().set(arg, ptr / 4);
-      WASM_VECTOR_LEN = arg.length;
-      return ptr;
-    }
-    function getArrayU8FromWasm0(ptr, len) {
-      ptr = ptr >>> 0;
-      return getUint8ArrayMemory0().subarray(ptr / 1, ptr / 1 + len);
-    }
-    module.exports.get_encoding = function(encoding, extend_special_tokens) {
-      if (wasm == null) throw new Error("tiktoken: WASM binary has not been propery initialized.");
-      try {
-        const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
-        const ptr0 = passStringToWasm0(encoding, wasm.__wbindgen_export_1, wasm.__wbindgen_export_2);
-        const len0 = WASM_VECTOR_LEN;
-        wasm.get_encoding(retptr, ptr0, len0, addHeapObject(extend_special_tokens));
-        var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
-        var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
-        var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);
-        if (r2) {
-          throw takeObject(r1);
-        }
-        return Tiktoken.__wrap(r0);
-      } finally {
-        wasm.__wbindgen_add_to_stack_pointer(16);
-      }
-    };
-    module.exports.encoding_for_model = function(model, extend_special_tokens) {
-      if (wasm == null) throw new Error("tiktoken: WASM binary has not been propery initialized.");
-      try {
-        const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
-        const ptr0 = passStringToWasm0(model, wasm.__wbindgen_export_1, wasm.__wbindgen_export_2);
-        const len0 = WASM_VECTOR_LEN;
-        wasm.encoding_for_model(retptr, ptr0, len0, addHeapObject(extend_special_tokens));
-        var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
-        var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
-        var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);
-        if (r2) {
-          throw takeObject(r1);
-        }
-        return Tiktoken.__wrap(r0);
-      } finally {
-        wasm.__wbindgen_add_to_stack_pointer(16);
-      }
-    };
-    module.exports.get_encoding_name_for_model = function(model) {
-      if (wasm == null) throw new Error("tiktoken: WASM binary has not been propery initialized.");
-      let deferred3_0;
-      let deferred3_1;
-      try {
-        const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
-        const ptr0 = passStringToWasm0(model, wasm.__wbindgen_export_1, wasm.__wbindgen_export_2);
-        const len0 = WASM_VECTOR_LEN;
-        wasm.get_encoding_name_for_model(retptr, ptr0, len0);
-        var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
-        var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
-        var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);
-        var r3 = getDataViewMemory0().getInt32(retptr + 4 * 3, true);
-        var ptr2 = r0;
-        var len2 = r1;
-        if (r3) {
-          ptr2 = 0;
-          len2 = 0;
-          throw takeObject(r2);
-        }
-        deferred3_0 = ptr2;
-        deferred3_1 = len2;
-        return getStringFromWasm0(ptr2, len2);
-      } finally {
-        wasm.__wbindgen_add_to_stack_pointer(16);
-        wasm.__wbindgen_export_3(deferred3_0, deferred3_1, 1);
-      }
-    };
-    var TiktokenFinalization = typeof FinalizationRegistry === "undefined" ? { register: () => {
-    }, unregister: () => {
-    } } : new FinalizationRegistry((ptr) => wasm.__wbg_tiktoken_free(ptr >>> 0, 1));
-    var Tiktoken = class _Tiktoken {
-      /**
-       * @param {string} tiktoken_bfe
-       * @param {any} special_tokens
-       * @param {string} pat_str
-       */
-      constructor(tiktoken_bfe, special_tokens, pat_str) {
-        if (wasm == null) throw new Error("tiktoken: WASM binary has not been propery initialized.");
-        const ptr0 = passStringToWasm0(tiktoken_bfe, wasm.__wbindgen_export_1, wasm.__wbindgen_export_2);
-        const len0 = WASM_VECTOR_LEN;
-        const ptr1 = passStringToWasm0(pat_str, wasm.__wbindgen_export_1, wasm.__wbindgen_export_2);
-        const len1 = WASM_VECTOR_LEN;
-        const ret = wasm.tiktoken_new(ptr0, len0, addHeapObject(special_tokens), ptr1, len1);
-        this.__wbg_ptr = ret >>> 0;
-        TiktokenFinalization.register(this, this.__wbg_ptr, this);
-        return this;
-      }
-      /** @returns {string | undefined} */
-      get name() {
-        try {
-          const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
-          wasm.tiktoken_name(retptr, this.__wbg_ptr);
-          var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
-          var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
-          let v1;
-          if (r0 !== 0) {
-            v1 = getStringFromWasm0(r0, r1).slice();
-            wasm.__wbindgen_export_3(r0, r1 * 1, 1);
-          }
-          return v1;
-        } finally {
-          wasm.__wbindgen_add_to_stack_pointer(16);
-        }
-      }
-      static __wrap(ptr) {
-        ptr = ptr >>> 0;
-        const obj = Object.create(_Tiktoken.prototype);
-        obj.__wbg_ptr = ptr;
-        TiktokenFinalization.register(obj, obj.__wbg_ptr, obj);
-        return obj;
-      }
-      __destroy_into_raw() {
-        const ptr = this.__wbg_ptr;
-        this.__wbg_ptr = 0;
-        TiktokenFinalization.unregister(this);
-        return ptr;
-      }
-      free() {
-        if (wasm == null) throw new Error("tiktoken: WASM binary has not been propery initialized.");
-        const ptr = this.__destroy_into_raw();
-        wasm.__wbg_tiktoken_free(ptr, 0);
-      }
-      /**
-       * @param {string} text
-       * @param {any} allowed_special
-       * @param {any} disallowed_special
-       * @returns {Uint32Array}
-       */
-      encode(text, allowed_special, disallowed_special) {
-        if (wasm == null) throw new Error("tiktoken: WASM binary has not been propery initialized.");
-        try {
-          const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
-          const ptr0 = passStringToWasm0(text, wasm.__wbindgen_export_1, wasm.__wbindgen_export_2);
-          const len0 = WASM_VECTOR_LEN;
-          wasm.tiktoken_encode(retptr, this.__wbg_ptr, ptr0, len0, addHeapObject(allowed_special), addHeapObject(disallowed_special));
-          var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
-          var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
-          var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);
-          var r3 = getDataViewMemory0().getInt32(retptr + 4 * 3, true);
-          if (r3) {
-            throw takeObject(r2);
-          }
-          var v2 = getArrayU32FromWasm0(r0, r1).slice();
-          wasm.__wbindgen_export_3(r0, r1 * 4, 4);
-          return v2;
-        } finally {
-          wasm.__wbindgen_add_to_stack_pointer(16);
-        }
-      }
-      /**
-       * @param {string} text
-       * @returns {Uint32Array}
-       */
-      encode_ordinary(text) {
-        if (wasm == null) throw new Error("tiktoken: WASM binary has not been propery initialized.");
-        try {
-          const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
-          const ptr0 = passStringToWasm0(text, wasm.__wbindgen_export_1, wasm.__wbindgen_export_2);
-          const len0 = WASM_VECTOR_LEN;
-          wasm.tiktoken_encode_ordinary(retptr, this.__wbg_ptr, ptr0, len0);
-          var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
-          var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
-          var v2 = getArrayU32FromWasm0(r0, r1).slice();
-          wasm.__wbindgen_export_3(r0, r1 * 4, 4);
-          return v2;
-        } finally {
-          wasm.__wbindgen_add_to_stack_pointer(16);
-        }
-      }
-      /**
-       * @param {string} text
-       * @param {any} allowed_special
-       * @param {any} disallowed_special
-       * @returns {any}
-       */
-      encode_with_unstable(text, allowed_special, disallowed_special) {
-        if (wasm == null) throw new Error("tiktoken: WASM binary has not been propery initialized.");
-        try {
-          const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
-          const ptr0 = passStringToWasm0(text, wasm.__wbindgen_export_1, wasm.__wbindgen_export_2);
-          const len0 = WASM_VECTOR_LEN;
-          wasm.tiktoken_encode_with_unstable(retptr, this.__wbg_ptr, ptr0, len0, addHeapObject(allowed_special), addHeapObject(disallowed_special));
-          var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
-          var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
-          var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);
-          if (r2) {
-            throw takeObject(r1);
-          }
-          return takeObject(r0);
-        } finally {
-          wasm.__wbindgen_add_to_stack_pointer(16);
-        }
-      }
-      /**
-       * @param {Uint8Array} bytes
-       * @returns {number}
-       */
-      encode_single_token(bytes) {
-        if (wasm == null) throw new Error("tiktoken: WASM binary has not been propery initialized.");
-        const ptr0 = passArray8ToWasm0(bytes, wasm.__wbindgen_export_1);
-        const len0 = WASM_VECTOR_LEN;
-        const ret = wasm.tiktoken_encode_single_token(this.__wbg_ptr, ptr0, len0);
-        return ret >>> 0;
-      }
-      /**
-       * @param {Uint32Array} tokens
-       * @returns {Uint8Array}
-       */
-      decode(tokens) {
-        if (wasm == null) throw new Error("tiktoken: WASM binary has not been propery initialized.");
-        try {
-          const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
-          const ptr0 = passArray32ToWasm0(tokens, wasm.__wbindgen_export_1);
-          const len0 = WASM_VECTOR_LEN;
-          wasm.tiktoken_decode(retptr, this.__wbg_ptr, ptr0, len0);
-          var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
-          var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
-          var v2 = getArrayU8FromWasm0(r0, r1).slice();
-          wasm.__wbindgen_export_3(r0, r1 * 1, 1);
-          return v2;
-        } finally {
-          wasm.__wbindgen_add_to_stack_pointer(16);
-        }
-      }
-      /**
-       * @param {number} token
-       * @returns {Uint8Array}
-       */
-      decode_single_token_bytes(token) {
-        if (wasm == null) throw new Error("tiktoken: WASM binary has not been propery initialized.");
-        try {
-          const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
-          wasm.tiktoken_decode_single_token_bytes(retptr, this.__wbg_ptr, token);
-          var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
-          var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
-          var v1 = getArrayU8FromWasm0(r0, r1).slice();
-          wasm.__wbindgen_export_3(r0, r1 * 1, 1);
-          return v1;
-        } finally {
-          wasm.__wbindgen_add_to_stack_pointer(16);
-        }
-      }
-      /** @returns {any} */
-      token_byte_values() {
-        if (wasm == null) throw new Error("tiktoken: WASM binary has not been propery initialized.");
-        const ret = wasm.tiktoken_token_byte_values(this.__wbg_ptr);
-        return takeObject(ret);
-      }
-    };
-    module.exports.Tiktoken = Tiktoken;
-    module.exports.__wbg_parse_def2e24ef1252aff = function() {
-      return handleError(function(arg0, arg1) {
-        const ret = JSON.parse(getStringFromWasm0(arg0, arg1));
-        return addHeapObject(ret);
-      }, arguments);
-    };
-    module.exports.__wbg_stringify_f7ed6987935b4a24 = function() {
-      return handleError(function(arg0) {
-        const ret = JSON.stringify(getObject(arg0));
-        return addHeapObject(ret);
-      }, arguments);
-    };
-    module.exports.__wbindgen_error_new = function(arg0, arg1) {
-      const ret = new Error(getStringFromWasm0(arg0, arg1));
-      return addHeapObject(ret);
-    };
-    module.exports.__wbindgen_is_undefined = function(arg0) {
-      const ret = getObject(arg0) === void 0;
-      return ret;
-    };
-    module.exports.__wbindgen_object_drop_ref = function(arg0) {
-      takeObject(arg0);
-    };
-    module.exports.__wbindgen_string_get = function(arg0, arg1) {
-      if (wasm == null) throw new Error("tiktoken: WASM binary has not been propery initialized.");
-      const obj = getObject(arg1);
-      const ret = typeof obj === "string" ? obj : void 0;
-      var ptr1 = isLikeNone(ret) ? 0 : passStringToWasm0(ret, wasm.__wbindgen_export_1, wasm.__wbindgen_export_2);
-      var len1 = WASM_VECTOR_LEN;
-      getDataViewMemory0().setInt32(arg0 + 4 * 1, len1, true);
-      getDataViewMemory0().setInt32(arg0 + 4 * 0, ptr1, true);
-    };
-    module.exports.__wbindgen_throw = function(arg0, arg1) {
-      throw new Error(getStringFromWasm0(arg0, arg1));
-    };
-  }
-});
-
-// node_modules/.pnpm/tiktoken@1.0.22/node_modules/tiktoken/tiktoken.cjs
-var require_tiktoken = __commonJS({
-  "node_modules/.pnpm/tiktoken@1.0.22/node_modules/tiktoken/tiktoken.cjs"(exports) {
-    var wasm = require_tiktoken_bg();
-    var imports = {};
-    imports["./tiktoken_bg.js"] = wasm;
-    var path12 = __require("path");
-    var fs10 = __require("fs");
-    var candidates = __dirname.split(path12.sep).reduce((memo, _3, index, array2) => {
-      const prefix = array2.slice(0, index + 1).join(path12.sep) + path12.sep;
-      if (!prefix.includes("node_modules" + path12.sep)) {
-        memo.unshift(
-          path12.join(
-            prefix,
-            "node_modules",
-            "tiktoken",
-            "",
-            "./tiktoken_bg.wasm"
-          )
-        );
-      }
-      return memo;
-    }, []);
-    candidates.unshift(path12.join(__dirname, "./tiktoken_bg.wasm"));
-    var bytes = null;
-    for (const candidate of candidates) {
-      try {
-        bytes = fs10.readFileSync(candidate);
-        break;
-      } catch {
-      }
-    }
-    if (bytes == null) throw new Error("Missing tiktoken_bg.wasm");
-    var wasmModule = new WebAssembly.Module(bytes);
-    var wasmInstance = new WebAssembly.Instance(wasmModule, imports);
-    wasm.__wbg_set_wasm(wasmInstance.exports);
-    exports["get_encoding"] = wasm["get_encoding"];
-    exports["encoding_for_model"] = wasm["encoding_for_model"];
-    exports["get_encoding_name_for_model"] = wasm["get_encoding_name_for_model"];
-    exports["Tiktoken"] = wasm["Tiktoken"];
-  }
-});
-
 // src/utils/tokens.ts
-function getEncoder() {
-  if (!encoder && encodingForModel) {
-    encoder = encodingForModel("gpt-4");
+import { createRequire } from "node:module";
+function loadEncodingForModel() {
+  if (loadAttempted) return encodingForModel;
+  loadAttempted = true;
+  try {
+    const req = createRequire(import.meta.url);
+    const tiktoken = req("tiktoken");
+    encodingForModel = tiktoken.encoding_for_model;
+  } catch {
   }
+  return encodingForModel;
+}
+function getEncoder() {
+  if (encoder) return encoder;
+  const loader = loadEncodingForModel();
+  if (!loader) return null;
+  encoder = loader("gpt-4");
   return encoder;
 }
 function countTokens(text) {
+  if (!text) return 0;
   const enc = getEncoder();
   if (!enc) {
     return Math.ceil(text.length / 4);
@@ -34968,16 +34523,12 @@ function freeEncoder() {
 function keepEncoderAlive(keep) {
   _keepAlive = keep;
 }
-var encodingForModel, encoder, _keepAlive;
+var encodingForModel, loadAttempted, encoder, _keepAlive;
 var init_tokens = __esm({
-  async "src/utils/tokens.ts"() {
+  "src/utils/tokens.ts"() {
     "use strict";
     encodingForModel = null;
-    try {
-      const tiktoken = await Promise.resolve().then(() => __toESM(require_tiktoken(), 1));
-      encodingForModel = tiktoken.encoding_for_model;
-    } catch {
-    }
+    loadAttempted = false;
     encoder = null;
     _keepAlive = false;
   }
@@ -35067,6 +34618,10 @@ function extractPathReferences(lines, sections) {
       if (PATH_EXCLUDE.test(value)) continue;
       if (value.length < 3) continue;
       if (/^v?\d+\.\d+\//.test(value)) continue;
+      if (/^\d+\/\d+$/.test(value)) continue;
+      if (/^[A-Z][\w.-]*\/[A-Z][\w.-]*$/.test(value) && !value.includes(".")) {
+        continue;
+      }
       const column = match.index + match[0].length - match[1].length + 1;
       paths.push({
         value,
@@ -35171,11 +34726,11 @@ function extractCommandReferences(lines, sections) {
 }
 var PATH_PATTERN, PATH_EXCLUDE, COMMAND_PREFIXES, COMMON_COMMANDS;
 var init_parser = __esm({
-  async "src/core/parser.ts"() {
+  "src/core/parser.ts"() {
     "use strict";
     init_fs();
-    await init_tokens();
-    PATH_PATTERN = /(?:^|[\s`"'(])((\.{0,2}\/)?(?:[\w@.-]+\/)+[\w.*-]+(?:\.\w+)?)(?=[\s`"'),;:]|$)/gm;
+    init_tokens();
+    PATH_PATTERN = /(?:^|[\s`"'(])((\.{0,2}\/)?(?:[\w@.-]+\/)+[\w.*-]*(?:\.\w+)?)(?=[\s`"'),;:]|$)/gm;
     PATH_EXCLUDE = /^(https?:\/\/|ftp:\/\/|mailto:|n\/a|w\/o|I\/O|i\/o|e\.g\.|N\/A|\.deb\/|\.rpm[.\/]|\.tar[.\/]|\.zip[.\/])/i;
     COMMAND_PREFIXES = /^\s*[\$>]\s+(.+)$/;
     COMMON_COMMANDS = /^(npm|npx|pnpm|yarn|make|cargo|go\s+(run|build|test)|python|pytest|vitest|jest|bun|deno)\b/;
@@ -41488,21 +41043,6 @@ async function checkCommands(file2, projectRoot) {
   const makefile = loadMakefile(projectRoot);
   for (const ref of file2.references.commands) {
     const cmd = ref.value;
-    const writeMatch = cmd.match(NPM_WRITE_OP_PATTERN);
-    if (writeMatch) {
-      const op = writeMatch[1].split(/\s+/)[0];
-      if (op !== "publish") {
-        issues.push({
-          severity: "info",
-          check: "commands",
-          ruleId: "commands/npm-auth-trap",
-          line: ref.line,
-          message: `"${cmd}" \u2014 npm ${op} requires a 2FA-authenticated session; CLI returns 422 under WebAuthn-only auth`,
-          suggestion: "Under WebAuthn 2FA without a TOTP fallback, the npm website UI (npmjs.com/package/<pkg>/settings) is the only path that works. For recurring writes, prefer a CI-driven workflow using a granular NPM_TOKEN secret.",
-          detail: "npm treats CLI web-auth tokens as not-2FA-authenticated for writes; WebAuthn yields no TOTP code to satisfy the check."
-        });
-      }
-    }
     const scriptMatch = cmd.match(NPM_SCRIPT_PATTERN);
     if (scriptMatch && pkgJson) {
       const scriptName = scriptMatch[1];
@@ -41622,7 +41162,7 @@ function hasMakeTarget(makefile, target) {
   const pattern = new RegExp(`^${target.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\s*:`, "m");
   return pattern.test(makefile);
 }
-var NPM_SCRIPT_PATTERN, MAKE_PATTERN, NPX_PATTERN, NPM_WRITE_OP_PATTERN;
+var NPM_SCRIPT_PATTERN, MAKE_PATTERN, NPX_PATTERN;
 var init_commands = __esm({
   "src/core/checks/commands.ts"() {
     "use strict";
@@ -41630,7 +41170,6 @@ var init_commands = __esm({
     NPM_SCRIPT_PATTERN = /^(?:npm\s+run|pnpm(?:\s+run)?|yarn(?:\s+run)?|bun(?:\s+run)?)\s+(\S+)/;
     MAKE_PATTERN = /^make\s+(\S+)/;
     NPX_PATTERN = /^npx\s+(\S+)/;
-    NPM_WRITE_OP_PATTERN = /^npm\s+(publish|deprecate|unpublish|access\s+(grant|revoke|2fa)|dist-tag\s+(add|rm|set)|owner\s+(add|rm))\b/;
   }
 });
 
@@ -41801,8 +41340,8 @@ function isAlwaysLoaded(file2) {
   if (rel.includes("/rules/")) {
     return !hasPathsFrontmatter(file2.content);
   }
-  const basename2 = rel.split("/").pop() ?? "";
-  return ALWAYS_LOADED_BASENAMES.has(basename2);
+  const basename3 = rel.split("/").pop() ?? "";
+  return ALWAYS_LOADED_BASENAMES.has(basename3);
 }
 function computeSectionCosts(file2) {
   if (file2.sections.length === 0) return [];
@@ -41830,16 +41369,21 @@ function loadSettingsSources(projectRoot) {
   }
   return sources;
 }
+function canonicalizeCommand(backticked) {
+  const beforeFlags = backticked.trim().split(/\s+--?/, 1)[0];
+  return beforeFlags.replace(/\s+/g, " ");
+}
 function commandIsEnforced(cmd, settings) {
-  const lower = cmd.toLowerCase();
+  const escaped = cmd.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const pattern = new RegExp(`\\b${escaped}\\b`, "i");
   for (const s of settings) {
     for (const entry of s.permissions?.deny ?? []) {
-      if (entry.toLowerCase().includes(lower)) return true;
+      if (pattern.test(entry)) return true;
     }
     for (const h2 of s.hooks?.PreToolUse ?? []) {
-      if ((h2.matcher || "").toLowerCase().includes(lower)) return true;
+      if (pattern.test(h2.matcher || "")) return true;
       for (const sub of h2.hooks ?? []) {
-        if ((sub.command || "").toLowerCase().includes(lower)) return true;
+        if (pattern.test(sub.command || "")) return true;
       }
     }
   }
@@ -41850,10 +41394,9 @@ function checkHardEnforcement(file2, settings) {
   const lines = file2.content.split("\n");
   for (let i2 = 0; i2 < lines.length; i2++) {
     const line = lines[i2];
-    if (!INVIOLABLE_FRAMING.test(line)) continue;
-    COMMAND_IN_BACKTICKS.lastIndex = 0;
-    const matches = [...line.matchAll(COMMAND_IN_BACKTICKS)].map((m) => m[1]);
-    const cmd = matches.find((m) => /^[\w.-][\w\s.-]*/.test(m) && !m.includes("/"));
+    const match = line.match(INVIOLABLE_WITH_COMMAND);
+    if (!match) continue;
+    const cmd = canonicalizeCommand(match[2]);
     if (!cmd) continue;
     if (commandIsEnforced(cmd, settings)) continue;
     issues.push({
@@ -41862,7 +41405,7 @@ function checkHardEnforcement(file2, settings) {
       ruleId: "tier-tokens/hard-enforcement-missing",
       line: i2 + 1,
       message: `Inviolable framing ("${line.trim().slice(0, 80)}") without a hook to back it up`,
-      suggestion: `Rules in always-loaded files are advisory. For "${cmd}", add a PreToolUse hook (or permissions.deny entry) in .claude/settings.json so the command is physically blocked.`
+      suggestion: `Rules in always-loaded files are advisory. For \`${cmd}\`, add a PreToolUse hook (or permissions.deny entry) in .claude/settings.json so the command is physically blocked.`
     });
   }
   return issues;
@@ -41910,11 +41453,11 @@ function checkAggregateTierTokens(files) {
     suggestion: "Consider moving the largest files or their heaviest sections to on-demand tiers (skills, subagents, memory)."
   };
 }
-var ALWAYS_LOADED_BASENAMES, TOP_SECTIONS_TO_REPORT, INVIOLABLE_FRAMING, COMMAND_IN_BACKTICKS;
+var ALWAYS_LOADED_BASENAMES, TOP_SECTIONS_TO_REPORT, INVIOLABLE_WITH_COMMAND;
 var init_tier_tokens = __esm({
-  async "src/core/checks/tier-tokens.ts"() {
+  "src/core/checks/tier-tokens.ts"() {
     "use strict";
-    await init_tokens();
+    init_tokens();
     init_tokens2();
     ALWAYS_LOADED_BASENAMES = /* @__PURE__ */ new Set([
       "CLAUDE.md",
@@ -41936,8 +41479,7 @@ var init_tier_tokens = __esm({
       "instructions.md"
     ]);
     TOP_SECTIONS_TO_REPORT = 3;
-    INVIOLABLE_FRAMING = /\b(NEVER|ALWAYS|DON'?T|DO NOT|MUST NOT)\b/i;
-    COMMAND_IN_BACKTICKS = /`([^`]+)`/g;
+    INVIOLABLE_WITH_COMMAND = /\b(NEVER|ALWAYS|DON'?T|DO NOT|MUST NOT)\b[^.!?`]{0,80}`([^`]+)`/i;
   }
 });
 
@@ -42060,10 +41602,10 @@ function escapeRegex2(str) {
 }
 var PACKAGE_TECH_MAP;
 var init_redundancy = __esm({
-  async "src/core/checks/redundancy.ts"() {
+  "src/core/checks/redundancy.ts"() {
     "use strict";
     init_fs();
-    await init_tokens();
+    init_tokens();
     PACKAGE_TECH_MAP = {
       react: ["React", "react"],
       "react-dom": ["React DOM", "ReactDOM"],
@@ -43219,22 +42761,70 @@ function checkMissingFromClient(configs) {
   }
   return issues;
 }
+function collectServerNameKeys(content, rootKey) {
+  const names = [];
+  let i2 = 0;
+  let depth = 0;
+  let inString = false;
+  let escape2 = false;
+  let rootKeyDepth = -1;
+  let pendingKey = "";
+  let collectingKey = false;
+  while (i2 < content.length) {
+    const c3 = content[i2];
+    if (escape2) {
+      escape2 = false;
+      if (collectingKey) pendingKey += c3;
+      i2++;
+      continue;
+    }
+    if (c3 === "\\" && inString) {
+      escape2 = true;
+      if (collectingKey) pendingKey += c3;
+      i2++;
+      continue;
+    }
+    if (c3 === '"') {
+      if (!inString) {
+        inString = true;
+        collectingKey = true;
+        pendingKey = "";
+      } else {
+        inString = false;
+        let j3 = i2 + 1;
+        while (j3 < content.length && /\s/.test(content[j3])) j3++;
+        if (content[j3] === ":") {
+          if (pendingKey === rootKey && rootKeyDepth === -1) {
+            rootKeyDepth = depth;
+          } else if (rootKeyDepth !== -1 && depth === rootKeyDepth + 1) {
+            names.push(pendingKey);
+          }
+        }
+        collectingKey = false;
+        pendingKey = "";
+      }
+      i2++;
+      continue;
+    }
+    if (inString) {
+      if (collectingKey) pendingKey += c3;
+      i2++;
+      continue;
+    }
+    if (c3 === "{" || c3 === "[") depth++;
+    else if (c3 === "}" || c3 === "]") depth--;
+    i2++;
+  }
+  return names;
+}
 function checkSingleFileIssues(configs) {
   const issues = [];
   for (const config2 of configs) {
-    const nameCount = /* @__PURE__ */ new Map();
-    const lines = config2.content.split("\n");
-    for (const server2 of config2.servers) {
-      const escaped = server2.name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-      const pattern = new RegExp(`"${escaped}"\\s*:`, "g");
-      let count = 0;
-      for (const line of lines) {
-        if (pattern.test(line)) count++;
-        pattern.lastIndex = 0;
-      }
-      nameCount.set(server2.name, count);
-    }
-    for (const [name, count] of nameCount) {
+    if (!config2.actualRootKey) continue;
+    const serverKeys = collectServerNameKeys(config2.content, config2.actualRootKey);
+    const counts = /* @__PURE__ */ new Map();
+    for (const k3 of serverKeys) counts.set(k3, (counts.get(k3) ?? 0) + 1);
+    for (const [name, count] of counts) {
       if (count > 1) {
         issues.push({
           severity: "warning",
@@ -43584,7 +43174,10 @@ var init_session_scanner = __esm({
 });
 
 // src/core/checks/session/missing-secret.ts
-import { resolve as resolve5 } from "node:path";
+import { resolve as resolve5, basename as basename2 } from "node:path";
+function normalizePath(p2) {
+  return resolve5(p2).replace(/\\/g, "/").toLowerCase();
+}
 async function checkMissingSecret(ctx) {
   const issues = [];
   const secrets = [];
@@ -43604,15 +43197,25 @@ async function checkMissingSecret(ctx) {
     byName.get(s.name).add(s.project);
     if (s.repo) byName.get(s.name).add(s.repo);
   }
-  const currentNorm = resolve5(ctx.currentProject).replace(/\\/g, "/");
+  const currentNorm = normalizePath(ctx.currentProject);
+  const currentBase = basename2(currentNorm);
   for (const [secretName, projects] of byName) {
-    const currentHas = [...projects].some(
-      (p2) => p2.includes(currentNorm) || currentNorm.includes(p2.replace(/\\/g, "/")) || p2.includes(resolve5(ctx.currentProject).split(/[/\\]/).pop() || "")
-    );
+    const normalizedProjects = [...projects].map(normalizePath);
+    const currentHas = normalizedProjects.some((p2) => {
+      if (p2 === currentNorm) return true;
+      const lastSegment = p2.split("/").pop() || "";
+      return lastSegment === currentBase;
+    });
     if (currentHas) continue;
-    const siblingMatches = ctx.siblings.filter(
-      (sib) => [...projects].some((p2) => p2.replace(/\\/g, "/").includes(sib.name) || p2.includes(sib.path))
-    );
+    const siblingMatches = ctx.siblings.filter((sib) => {
+      const sibNorm = normalizePath(sib.path);
+      const sibBase = basename2(sibNorm);
+      return normalizedProjects.some((p2) => {
+        if (p2 === sibNorm) return true;
+        const lastSegment = p2.split("/").pop() || "";
+        return lastSegment === sibBase;
+      });
+    });
     if (siblingMatches.length >= 2) {
       const sibNames = siblingMatches.map((s) => s.name).join(", ");
       issues.push({
@@ -43769,6 +43372,15 @@ var init_missing_workflow = __esm({
 // src/core/checks/session/stale-memory.ts
 import { existsSync as existsSync4 } from "node:fs";
 import { resolve as resolve6, isAbsolute } from "node:path";
+function resolveRef2(ref, projectRoot) {
+  if (ref.startsWith("~/") || ref === "~") {
+    const home2 = process.env.HOME || process.env.USERPROFILE;
+    if (!home2) return null;
+    return ref === "~" ? home2 : resolve6(home2, ref.slice(2));
+  }
+  if (isAbsolute(ref)) return ref;
+  return resolve6(projectRoot, ref);
+}
 async function checkStaleMemory(ctx) {
   const issues = [];
   const projectMemories = ctx.memories.filter(
@@ -43777,7 +43389,8 @@ async function checkStaleMemory(ctx) {
   for (const mem of projectMemories) {
     const brokenPaths = [];
     for (const ref of mem.referencedPaths) {
-      const fullPath = isAbsolute(ref) ? ref : resolve6(ctx.currentProject, ref);
+      const fullPath = resolveRef2(ref, ctx.currentProject);
+      if (!fullPath) continue;
       if (!existsSync4(fullPath)) {
         brokenPaths.push(ref);
       }
@@ -44153,7 +43766,7 @@ import { readFileSync as readFileSync4 } from "node:fs";
 import { resolve as resolve8, dirname as dirname3 } from "node:path";
 import { fileURLToPath } from "node:url";
 function loadVersion() {
-  if (true) return "0.9.4";
+  if (true) return "0.9.6";
   const __dir = dirname3(fileURLToPath(import.meta.url));
   const pkgPath = resolve8(__dir, "../package.json");
   const pkg = JSON.parse(readFileSync4(pkgPath, "utf-8"));
@@ -44365,18 +43978,18 @@ async function runAudit(projectRoot, activeChecks, options = {}) {
 }
 var ALL_CHECKS, ALL_MCP_CHECKS, ALL_SESSION_CHECKS;
 var init_audit = __esm({
-  async "src/core/audit.ts"() {
+  "src/core/audit.ts"() {
     "use strict";
     init_scanner();
-    await init_parser();
+    init_parser();
     init_mcp_parser();
-    await init_tokens();
+    init_tokens();
     init_paths();
     init_commands();
     init_staleness();
     init_tokens2();
-    await init_tier_tokens();
-    await init_redundancy();
+    init_tier_tokens();
+    init_redundancy();
     init_contradictions();
     init_frontmatter();
     init_schema();
@@ -44975,16 +44588,32 @@ import * as fs7 from "node:fs";
 function applyFixes(result, options = {}) {
   const log = options.quiet ? () => {
   } : console.log.bind(console);
+  const dryRun = options.dryRun ?? false;
+  const skipSymlinks = options.skipSymlinks ?? true;
+  const symlinkFiles = /* @__PURE__ */ new Set();
+  if (skipSymlinks) {
+    for (const f of result.files) {
+      if (f.isSymlink) symlinkFiles.add(f.path);
+    }
+  }
   const fixesByFile = /* @__PURE__ */ new Map();
+  const skippedSymlinks = /* @__PURE__ */ new Set();
   for (const file2 of result.files) {
     for (const issue2 of file2.issues) {
       if (issue2.fix) {
+        if (skipSymlinks && file2.isSymlink) {
+          skippedSymlinks.add(file2.path);
+          continue;
+        }
         const existing = fixesByFile.get(issue2.fix.file) || [];
         existing.push(issue2.fix);
         fixesByFile.set(issue2.fix.file, existing);
       }
     }
   }
+  for (const p2 of skippedSymlinks) {
+    log(source_default.yellow("  Skipped") + ` ${p2}: symlink (use --follow-symlinks to override)`);
+  }
   let totalFixes = 0;
   const filesModified = [];
   for (const [filePath, fixes] of fixesByFile) {
@@ -45006,8 +44635,9 @@ function applyFixes(result, options = {}) {
         if (line.includes(fix.oldText)) {
           line = line.replace(fix.oldText, fix.newText);
           totalFixes++;
+          const prefix = dryRun ? source_default.cyan("  Would fix") : source_default.green("  Fixed");
           log(
-            source_default.green("  Fixed") + ` Line ${fix.line}: ${source_default.dim(fix.oldText)} ${source_default.dim("\u2192")} ${fix.newText}`
+            prefix + ` Line ${fix.line}: ${source_default.dim(fix.oldText)} ${source_default.dim("\u2192")} ${fix.newText}`
           );
         }
       }
@@ -45026,7 +44656,9 @@ function applyFixes(result, options = {}) {
           continue;
         }
       }
-      fs7.writeFileSync(filePath, newContent, "utf-8");
+      if (!dryRun) {
+        fs7.writeFileSync(filePath, newContent, "utf-8");
+      }
       filesModified.push(filePath);
     }
   }
@@ -45050,12 +44682,12 @@ var init_server3 = __esm({
     init_stdio2();
     init_zod();
     init_scanner();
-    await init_parser();
-    await init_audit();
+    init_parser();
+    init_audit();
     init_fixer();
     init_fs();
     init_git();
-    await init_tokens();
+    init_tokens();
     init_git();
     init_paths();
     init_version2();
@@ -51984,6 +51616,13 @@ function buildRuleDescriptors() {
       shortDescription: { text: "Context file token usage" },
       helpUri: "https://github.com/yawlabs/ctxlint#what-it-checks"
     },
+    {
+      id: "ctxlint/tier-tokens",
+      shortDescription: {
+        text: "Tier-aware token accounting for always-loaded context files"
+      },
+      helpUri: "https://github.com/yawlabs/ctxlint#what-it-checks"
+    },
     {
       id: "ctxlint/redundancy",
       shortDescription: { text: "Content is redundant or inferable" },
@@ -52078,6 +51717,13 @@ function buildRuleDescriptors() {
       id: "ctxlint/session-loop-detection",
       shortDescription: { text: "Agent looping pattern detected in session history" },
       helpUri: "https://github.com/yawlabs/ctxlint#what-it-checks"
+    },
+    {
+      id: "ctxlint/session-memory-index-overflow",
+      shortDescription: {
+        text: "MEMORY.md exceeds Claude Code's 200-line / 25KB session-load cap"
+      },
+      helpUri: "https://github.com/yawlabs/ctxlint#what-it-checks"
     }
   ];
 }
@@ -52155,7 +51801,7 @@ async function runCli() {
     "Lint your AI agent context files and MCP server configs against your actual codebase"
   ).version(VERSION).argument("[path]", "Project directory to scan", ".").option("--strict", "Exit code 1 on any warning or error (for CI)", false).option("--checks <checks>", "Comma-separated list of checks to run", "").addOption(
     new Option("--format <format>", "Output format: text, json, or sarif").choices(["text", "json", "sarif"]).default("text")
-  ).option("--tokens", "Show token breakdown per file", false).option("--verbose", "Show passing checks too", false).option("--fix", "Auto-fix broken paths using git history and fuzzy matching", false).option("--ignore <checks>", "Comma-separated list of checks to ignore", "").option("--quiet", "Suppress all output except errors (exit code only)", false).option("--config <path>", "Path to config file (default: .ctxlintrc in project root)").option("--depth <n>", "Max subdirectory depth to scan (default: 2)", "2").option("--mcp", "Enable MCP config linting alongside context file checks", false).option("--mcp-only", "Run only MCP config checks, skip context file checks", false).option("--mcp-global", "Also scan user/global MCP config files (implies --mcp)", false).option("--mcp-server", "Start the MCP server (for IDE/agent integration)").option("--session", "Run session audit checks (cross-project consistency)", false).option("--session-only", "Run only session checks, skip context and MCP checks", false).option("--watch", "Re-lint on context file changes", false).action(async (projectPath, opts) => {
+  ).option("--tokens", "Show token breakdown per file", false).option("--verbose", "Show passing checks too", false).option("--fix", "Auto-fix broken paths using git history and fuzzy matching", false).option("--fix-dry-run", "Preview --fix changes without writing", false).option("--yes", "Skip interactive confirmation prompts (required for --fix in TTY)", false).option("--follow-symlinks", "Allow --fix to write through symlinks (default: skip)", false).option("--ignore <checks>", "Comma-separated list of checks to ignore", "").option("--quiet", "Suppress all output except errors (exit code only)", false).option("--config <path>", "Path to config file (default: .ctxlintrc in project root)").option("--depth <n>", "Max subdirectory depth to scan (default: 2)", "2").option("--mcp", "Enable MCP config linting alongside context file checks", false).option("--mcp-only", "Run only MCP config checks, skip context file checks", false).option("--mcp-global", "Also scan user/global MCP config files (implies --mcp)", false).option("--mcp-server", "Start the MCP server (for IDE/agent integration)").option("--session", "Run session audit checks (cross-project consistency)", false).option("--session-only", "Run only session checks, skip context and MCP checks", false).option("--watch", "Re-lint on context file changes", false).action(async (projectPath, opts) => {
     const resolvedPath = path11.resolve(projectPath);
     const configPath = opts.config ? path11.resolve(opts.config) : void 0;
     const config2 = configPath ? loadConfigFromPath(configPath) : loadConfig(resolvedPath);
@@ -52237,14 +51883,59 @@ async function runCli() {
         }
         if (!opts.watch) return;
       }
-      if (options.fix) {
-        const fixSummary = applyFixes(result, { quiet: options.quiet });
-        if (fixSummary.totalFixes > 0 && !options.quiet) {
-          console.log(
-            `
-Fixed ${fixSummary.totalFixes} issue${fixSummary.totalFixes !== 1 ? "s" : ""} in ${fixSummary.filesModified.length} file${fixSummary.filesModified.length !== 1 ? "s" : ""}.
+      const dryRunFlag = opts.fixDryRun || false;
+      const yes = opts.yes || false;
+      const followSymlinks = opts.followSymlinks || false;
+      const isInteractive2 = !!process.stdout.isTTY && !options.quiet;
+      if (dryRunFlag || options.fix) {
+        const commonOpts = { quiet: options.quiet, skipSymlinks: !followSymlinks };
+        if (dryRunFlag) {
+          const preview = applyFixes(result, { ...commonOpts, dryRun: true });
+          if (!options.quiet) {
+            if (preview.totalFixes === 0) {
+              console.log("\nNo auto-fixable issues.\n");
+            } else {
+              console.log(
+                `
+Would fix ${preview.totalFixes} issue${preview.totalFixes !== 1 ? "s" : ""} in ${preview.filesModified.length} file${preview.filesModified.length !== 1 ? "s" : ""}. (dry-run \u2014 no files modified)
 `
-          );
+              );
+            }
+          }
+        } else if (options.fix) {
+          if (isInteractive2 && !yes) {
+            const preview = applyFixes(result, { ...commonOpts, dryRun: true });
+            if (preview.totalFixes === 0) {
+              console.log("\nNo auto-fixable issues.\n");
+            } else {
+              console.log(
+                `
+${preview.totalFixes} fix${preview.totalFixes !== 1 ? "es" : ""} proposed across ${preview.filesModified.length} file${preview.filesModified.length !== 1 ? "s" : ""}.`
+              );
+              const confirmed = await promptYesNo(
+                "Apply these fixes? Re-run with --yes to skip this prompt. [y/N] "
+              );
+              if (!confirmed) {
+                console.log("Aborted. No files modified.\n");
+              } else {
+                const applied = applyFixes(result, commonOpts);
+                console.log(
+                  `
+Fixed ${applied.totalFixes} issue${applied.totalFixes !== 1 ? "s" : ""} in ${applied.filesModified.length} file${applied.filesModified.length !== 1 ? "s" : ""}.
+`
+                );
+              }
+            }
+          } else {
+            const applied = applyFixes(result, commonOpts);
+            if (applied.totalFixes > 0 && !options.quiet) {
+              console.log(
+                `
+Fixed ${applied.totalFixes} issue${applied.totalFixes !== 1 ? "s" : ""} in ${applied.filesModified.length} file${applied.filesModified.length !== 1 ? "s" : ""}.
+`
+              );
+            }
+          }
         }
       }
       if (!options.quiet) {
@@ -52396,6 +52087,16 @@ npx @yawlabs/ctxlint --strict
   });
   program2.parse();
 }
+async function promptYesNo(question) {
+  const { createInterface: createInterface2 } = await import("node:readline/promises");
+  const rl = createInterface2({ input: process.stdin, output: process.stdout });
+  try {
+    const answer = await rl.question(question);
+    return /^\s*y(es)?\s*$/i.test(answer);
+  } finally {
+    rl.close();
+  }
+}
 function loadConfigFromPath(configPath) {
   try {
     const content = fs9.readFileSync(configPath, "utf-8");
@@ -52408,7 +52109,7 @@ function loadConfigFromPath(configPath) {
 }
 var VALID_CHECKS;
 var init_cli = __esm({
-  async "src/cli.ts"() {
+  "src/cli.ts"() {
     "use strict";
     init_esm3();
     init_ora();
@@ -52416,11 +52117,11 @@ var init_cli = __esm({
     init_tokens2();
     init_reporter();
     init_fixer();
-    await init_tokens();
+    init_tokens();
     init_git();
     init_fs();
     init_config2();
-    await init_audit();
+    init_audit();
     init_version2();
     VALID_CHECKS = /* @__PURE__ */ new Set([...ALL_CHECKS, ...ALL_MCP_CHECKS, ...ALL_SESSION_CHECKS]);
   }
@@ -52430,7 +52131,7 @@ var init_cli = __esm({
 if (process.argv.includes("--mcp-server")) {
   await init_server3().then(() => server_exports);
 } else {
-  const { runCli: runCli2 } = await init_cli().then(() => cli_exports);
+  const { runCli: runCli2 } = await Promise.resolve().then(() => (init_cli(), cli_exports));
   await runCli2();
 }
 //# sourceMappingURL=index.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yawlabs/ctxlint",
-  "version": "0.9.4",
+  "version": "0.9.6",
   "description": "Lint your AI agent context files, MCP server configs, and session data against your actual codebase",
   "bin": {
     "ctxlint": "dist/index.js"